Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 03:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b7ba64765e4e93c038188318bdc237d8c295d387aa9ca53fb7b4b5d32420a8b6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b7ba64765e4e93c038188318bdc237d8c295d387aa9ca53fb7b4b5d32420a8b6.exe
-
Size
454KB
-
MD5
95a1174ec655742760a9b4992be52a49
-
SHA1
024b85fa9692161143561b8503f84e466c8656f9
-
SHA256
b7ba64765e4e93c038188318bdc237d8c295d387aa9ca53fb7b4b5d32420a8b6
-
SHA512
af9ba99f18596608d98f9a4f344d9163a9e1ad46eca23f6a24b3e85615a68a01cbe7c6c0b6a2b3ac3db63e75618f26aa316d7686d215dee5f5c11016c0ac3b63
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1744-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-236-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/792-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-296-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-402-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3028-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-583-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/3012-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-676-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1664-702-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1056-727-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2988-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-861-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1928-965-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-1029-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/828-1094-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-1117-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-1158-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-1178-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-1209-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2320-1242-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1172 nhbhht.exe 2576 1rlrlrl.exe 3044 vpjvj.exe 2480 xxrfrxl.exe 2824 vvpdp.exe 2732 nhbhnt.exe 2724 xrlrffx.exe 1328 3llxrfx.exe 1140 rlfrfff.exe 2672 frllxfr.exe 2336 ppjjd.exe 2936 ddvdj.exe 2436 5vppj.exe 2676 lrflxxf.exe 2868 pjvjd.exe 2828 xffrxrx.exe 1960 1jvdd.exe 1208 9lxxlrf.exe 2076 pjvvd.exe 608 5lxflfl.exe 1508 tttbtt.exe 1660 5jvdj.exe 1728 nnhtnt.exe 2096 pjdjv.exe 2256 xrlrflx.exe 792 hhbbnn.exe 2468 7ttthh.exe 568 pjdjv.exe 2492 ntnhtt.exe 1764 djjjp.exe 2180 tnbbnn.exe 1604 ppjjd.exe 2004 rllrflf.exe 2524 tttbhh.exe 2788 pjvvv.exe 3044 djdpd.exe 2816 fxffxxl.exe 2068 tnhnhb.exe 2056 5jjpv.exe 2732 vvjpv.exe 2744 xxxfrxl.exe 2720 tbthnt.exe 2604 btthtt.exe 2640 jpdjv.exe 1952 xflxrrf.exe 804 1ttbht.exe 2996 bbtthb.exe 3036 ppdjp.exe 2852 xxxlfrl.exe 2884 nhtbnt.exe 2956 tbbhbb.exe 3028 jjddj.exe 2028 xrrfffl.exe 1864 5xllrrr.exe 1812 hbtbnn.exe 1476 dddjp.exe 380 1djvj.exe 1000 xxrrfrx.exe 1120 nhbbhh.exe 1980 hnbhht.exe 108 vppvj.exe 2168 3xxlfrl.exe 448 bbtbnn.exe 2988 ddpvp.exe -
resource yara_rule behavioral1/memory/1744-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-236-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/792-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-676-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2988-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-861-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2708-874-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-933-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-965-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2464-1029-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2492-1075-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-1101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-1117-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2056-1165-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2136-1178-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxlrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1744 wrote to memory of 1172 1744 b7ba64765e4e93c038188318bdc237d8c295d387aa9ca53fb7b4b5d32420a8b6.exe 30 PID 1744 wrote to memory of 1172 1744 b7ba64765e4e93c038188318bdc237d8c295d387aa9ca53fb7b4b5d32420a8b6.exe 30 PID 1744 wrote to memory of 1172 1744 b7ba64765e4e93c038188318bdc237d8c295d387aa9ca53fb7b4b5d32420a8b6.exe 30 PID 1744 wrote to memory of 1172 1744 b7ba64765e4e93c038188318bdc237d8c295d387aa9ca53fb7b4b5d32420a8b6.exe 30 PID 1172 wrote to memory of 2576 1172 nhbhht.exe 31 PID 1172 wrote to memory of 2576 1172 nhbhht.exe 31 PID 1172 wrote to memory of 2576 1172 nhbhht.exe 31 PID 1172 wrote to memory of 2576 1172 nhbhht.exe 31 PID 2576 wrote to memory of 3044 2576 1rlrlrl.exe 32 PID 2576 wrote to memory of 3044 2576 1rlrlrl.exe 32 PID 2576 wrote to memory of 3044 2576 1rlrlrl.exe 32 PID 2576 wrote to memory of 3044 2576 1rlrlrl.exe 32 PID 3044 wrote to memory of 2480 3044 vpjvj.exe 33 PID 3044 wrote to memory of 2480 3044 vpjvj.exe 33 PID 3044 wrote to memory of 2480 3044 vpjvj.exe 33 PID 3044 wrote to memory of 2480 3044 vpjvj.exe 33 PID 2480 wrote to memory of 2824 2480 xxrfrxl.exe 34 PID 2480 wrote to memory of 2824 2480 xxrfrxl.exe 34 PID 2480 wrote to memory of 2824 2480 xxrfrxl.exe 34 PID 2480 wrote to memory of 2824 2480 xxrfrxl.exe 34 PID 2824 wrote to memory of 2732 2824 vvpdp.exe 35 PID 2824 wrote to memory of 2732 2824 vvpdp.exe 35 PID 2824 wrote to memory of 2732 2824 vvpdp.exe 35 PID 2824 wrote to memory of 2732 2824 vvpdp.exe 35 PID 2732 wrote to memory of 2724 2732 nhbhnt.exe 36 PID 2732 wrote to memory of 2724 2732 nhbhnt.exe 36 PID 2732 wrote to memory of 2724 2732 nhbhnt.exe 36 PID 2732 wrote to memory of 2724 2732 nhbhnt.exe 36 PID 2724 wrote to memory of 1328 2724 xrlrffx.exe 37 PID 2724 wrote to memory of 1328 2724 xrlrffx.exe 37 PID 2724 wrote to memory of 1328 2724 xrlrffx.exe 37 PID 2724 wrote to memory of 1328 2724 xrlrffx.exe 37 PID 1328 wrote to memory of 1140 1328 3llxrfx.exe 38 PID 1328 wrote to memory of 1140 1328 3llxrfx.exe 38 PID 1328 wrote to memory of 1140 1328 3llxrfx.exe 38 PID 1328 wrote to memory of 1140 1328 3llxrfx.exe 38 PID 1140 wrote to memory of 2672 1140 rlfrfff.exe 39 PID 1140 wrote to memory of 2672 1140 rlfrfff.exe 39 PID 1140 wrote to memory of 2672 1140 rlfrfff.exe 39 PID 1140 wrote to memory of 2672 1140 rlfrfff.exe 39 PID 2672 wrote to memory of 2336 2672 frllxfr.exe 40 PID 2672 wrote to memory of 2336 2672 frllxfr.exe 40 PID 2672 wrote to memory of 2336 2672 frllxfr.exe 40 PID 2672 wrote to memory of 2336 2672 frllxfr.exe 40 PID 2336 wrote to memory of 2936 2336 ppjjd.exe 41 PID 2336 wrote to memory of 2936 2336 ppjjd.exe 41 PID 2336 wrote to memory of 2936 2336 ppjjd.exe 41 PID 2336 wrote to memory of 2936 2336 ppjjd.exe 41 PID 2936 wrote to memory of 2436 2936 ddvdj.exe 42 PID 2936 wrote to memory of 2436 2936 ddvdj.exe 42 PID 2936 wrote to memory of 2436 2936 ddvdj.exe 42 PID 2936 wrote to memory of 2436 2936 ddvdj.exe 42 PID 2436 wrote to memory of 2676 2436 5vppj.exe 43 PID 2436 wrote to memory of 2676 2436 5vppj.exe 43 PID 2436 wrote to memory of 2676 2436 5vppj.exe 43 PID 2436 wrote to memory of 2676 2436 5vppj.exe 43 PID 2676 wrote to memory of 2868 2676 lrflxxf.exe 44 PID 2676 wrote to memory of 2868 2676 lrflxxf.exe 44 PID 2676 wrote to memory of 2868 2676 lrflxxf.exe 44 PID 2676 wrote to memory of 2868 2676 lrflxxf.exe 44 PID 2868 wrote to memory of 2828 2868 pjvjd.exe 45 PID 2868 wrote to memory of 2828 2868 pjvjd.exe 45 PID 2868 wrote to memory of 2828 2868 pjvjd.exe 45 PID 2868 wrote to memory of 2828 2868 pjvjd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7ba64765e4e93c038188318bdc237d8c295d387aa9ca53fb7b4b5d32420a8b6.exe"C:\Users\Admin\AppData\Local\Temp\b7ba64765e4e93c038188318bdc237d8c295d387aa9ca53fb7b4b5d32420a8b6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\nhbhht.exec:\nhbhht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\1rlrlrl.exec:\1rlrlrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\vpjvj.exec:\vpjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\vvpdp.exec:\vvpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nhbhnt.exec:\nhbhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xrlrffx.exec:\xrlrffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\3llxrfx.exec:\3llxrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\rlfrfff.exec:\rlfrfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\frllxfr.exec:\frllxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\ppjjd.exec:\ppjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\ddvdj.exec:\ddvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5vppj.exec:\5vppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\lrflxxf.exec:\lrflxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\pjvjd.exec:\pjvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\xffrxrx.exec:\xffrxrx.exe17⤵
- Executes dropped EXE
PID:2828 -
\??\c:\1jvdd.exec:\1jvdd.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960 -
\??\c:\9lxxlrf.exec:\9lxxlrf.exe19⤵
- Executes dropped EXE
PID:1208 -
\??\c:\pjvvd.exec:\pjvvd.exe20⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5lxflfl.exec:\5lxflfl.exe21⤵
- Executes dropped EXE
PID:608 -
\??\c:\tttbtt.exec:\tttbtt.exe22⤵
- Executes dropped EXE
PID:1508 -
\??\c:\5jvdj.exec:\5jvdj.exe23⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nnhtnt.exec:\nnhtnt.exe24⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pjdjv.exec:\pjdjv.exe25⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xrlrflx.exec:\xrlrflx.exe26⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hhbbnn.exec:\hhbbnn.exe27⤵
- Executes dropped EXE
PID:792 -
\??\c:\7ttthh.exec:\7ttthh.exe28⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pjdjv.exec:\pjdjv.exe29⤵
- Executes dropped EXE
PID:568 -
\??\c:\ntnhtt.exec:\ntnhtt.exe30⤵
- Executes dropped EXE
PID:2492 -
\??\c:\djjjp.exec:\djjjp.exe31⤵
- Executes dropped EXE
PID:1764 -
\??\c:\tnbbnn.exec:\tnbbnn.exe32⤵
- Executes dropped EXE
PID:2180 -
\??\c:\ppjjd.exec:\ppjjd.exe33⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rllrflf.exec:\rllrflf.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tttbhh.exec:\tttbhh.exe35⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pjvvv.exec:\pjvvv.exe36⤵
- Executes dropped EXE
PID:2788 -
\??\c:\djdpd.exec:\djdpd.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\fxffxxl.exec:\fxffxxl.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tnhnhb.exec:\tnhnhb.exe39⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5jjpv.exec:\5jjpv.exe40⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vvjpv.exec:\vvjpv.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tbthnt.exec:\tbthnt.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\btthtt.exec:\btthtt.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jpdjv.exec:\jpdjv.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xflxrrf.exec:\xflxrrf.exe46⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1ttbht.exec:\1ttbht.exe47⤵
- Executes dropped EXE
PID:804 -
\??\c:\bbtthb.exec:\bbtthb.exe48⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ppdjp.exec:\ppdjp.exe49⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xxxlfrl.exec:\xxxlfrl.exe50⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nhtbnt.exec:\nhtbnt.exe51⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tbbhbb.exec:\tbbhbb.exe52⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jjddj.exec:\jjddj.exe53⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xrrfffl.exec:\xrrfffl.exe54⤵
- Executes dropped EXE
PID:2028 -
\??\c:\5xllrrr.exec:\5xllrrr.exe55⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hbtbnn.exec:\hbtbnn.exe56⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dddjp.exec:\dddjp.exe57⤵
- Executes dropped EXE
PID:1476 -
\??\c:\1djvj.exec:\1djvj.exe58⤵
- Executes dropped EXE
PID:380 -
\??\c:\xxrrfrx.exec:\xxrrfrx.exe59⤵
- Executes dropped EXE
PID:1000 -
\??\c:\nhbbhh.exec:\nhbbhh.exe60⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hnbhht.exec:\hnbhht.exe61⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vppvj.exec:\vppvj.exe62⤵
- Executes dropped EXE
PID:108 -
\??\c:\3xxlfrl.exec:\3xxlfrl.exe63⤵
- Executes dropped EXE
PID:2168 -
\??\c:\bbtbnn.exec:\bbtbnn.exe64⤵
- Executes dropped EXE
PID:448 -
\??\c:\ddpvp.exec:\ddpvp.exe65⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xxlxllf.exec:\xxlxllf.exe66⤵PID:556
-
\??\c:\5lfrflf.exec:\5lfrflf.exe67⤵PID:2284
-
\??\c:\hnthbt.exec:\hnthbt.exe68⤵PID:1512
-
\??\c:\jvdvv.exec:\jvdvv.exe69⤵PID:2272
-
\??\c:\xxrfllx.exec:\xxrfllx.exe70⤵PID:852
-
\??\c:\1hbhnn.exec:\1hbhnn.exe71⤵PID:2492
-
\??\c:\9jvjj.exec:\9jvjj.exe72⤵PID:2264
-
\??\c:\5jddp.exec:\5jddp.exe73⤵PID:1364
-
\??\c:\lfxflrf.exec:\lfxflrf.exe74⤵PID:1712
-
\??\c:\hhthnh.exec:\hhthnh.exe75⤵PID:2408
-
\??\c:\pddpj.exec:\pddpj.exe76⤵PID:1620
-
\??\c:\9llrlxr.exec:\9llrlxr.exe77⤵PID:2924
-
\??\c:\nhbtnt.exec:\nhbtnt.exe78⤵PID:2332
-
\??\c:\9hnbth.exec:\9hnbth.exe79⤵PID:2812
-
\??\c:\1dpvd.exec:\1dpvd.exe80⤵PID:2764
-
\??\c:\lllxxlf.exec:\lllxxlf.exe81⤵PID:2616
-
\??\c:\3ntthn.exec:\3ntthn.exe82⤵PID:3056
-
\??\c:\vvvjd.exec:\vvvjd.exe83⤵PID:2984
-
\??\c:\vjvjj.exec:\vjvjj.exe84⤵
- System Location Discovery: System Language Discovery
PID:2632 -
\??\c:\xrrrlrl.exec:\xrrrlrl.exe85⤵PID:1328
-
\??\c:\tthntb.exec:\tthntb.exe86⤵PID:2728
-
\??\c:\dvpdp.exec:\dvpdp.exe87⤵PID:2660
-
\??\c:\fxllxfl.exec:\fxllxfl.exe88⤵PID:2624
-
\??\c:\1rxxlrf.exec:\1rxxlrf.exe89⤵PID:1464
-
\??\c:\ttntth.exec:\ttntth.exe90⤵PID:2936
-
\??\c:\jvjvv.exec:\jvjvv.exe91⤵PID:1248
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe92⤵PID:3012
-
\??\c:\3flffrf.exec:\3flffrf.exe93⤵PID:2852
-
\??\c:\bbtbnn.exec:\bbtbnn.exe94⤵PID:2884
-
\??\c:\pjdpd.exec:\pjdpd.exe95⤵PID:784
-
\??\c:\fxxlllr.exec:\fxxlllr.exe96⤵PID:3028
-
\??\c:\hhnhnt.exec:\hhnhnt.exe97⤵PID:1664
-
\??\c:\ntnbbh.exec:\ntnbbh.exe98⤵PID:1232
-
\??\c:\vppdp.exec:\vppdp.exe99⤵PID:1812
-
\??\c:\llfrflx.exec:\llfrflx.exe100⤵PID:604
-
\??\c:\xflllxr.exec:\xflllxr.exe101⤵PID:1056
-
\??\c:\hhhnbn.exec:\hhhnbn.exe102⤵PID:2104
-
\??\c:\1jdjp.exec:\1jdjp.exe103⤵PID:1120
-
\??\c:\3xrxlxl.exec:\3xrxlxl.exe104⤵PID:1688
-
\??\c:\hbtnhb.exec:\hbtnhb.exe105⤵PID:108
-
\??\c:\vvvpj.exec:\vvvpj.exe106⤵PID:2588
-
\??\c:\pppdj.exec:\pppdj.exe107⤵PID:1116
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe108⤵PID:2988
-
\??\c:\tnnthn.exec:\tnnthn.exe109⤵PID:1516
-
\??\c:\3jjpv.exec:\3jjpv.exe110⤵PID:2456
-
\??\c:\vddvj.exec:\vddvj.exe111⤵PID:1776
-
\??\c:\ffrfxfr.exec:\ffrfxfr.exe112⤵PID:2036
-
\??\c:\pppdp.exec:\pppdp.exe113⤵PID:2012
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe114⤵PID:2492
-
\??\c:\3hhbbb.exec:\3hhbbb.exe115⤵PID:2264
-
\??\c:\vdjdj.exec:\vdjdj.exe116⤵PID:2692
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe117⤵PID:1528
-
\??\c:\3xllxxf.exec:\3xllxxf.exe118⤵PID:2688
-
\??\c:\hbbnbn.exec:\hbbnbn.exe119⤵PID:2572
-
\??\c:\jjvjv.exec:\jjvjv.exe120⤵PID:2796
-
\??\c:\frlxlrf.exec:\frlxlrf.exe121⤵PID:2800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-